ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Affects the Linux kernel ALSA usb-audio driver's Extigy and Mbox device quirks, where a bogus USB device can report an oversized bNumConfigurations value. Fixed by upstream kernel commits; no vendor rating is given.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's USB audio driver (ALSA usb-audio, used for Creative Extigy and M-Audio Mbox devices) can be made to access memory out of bounds when a malicious or malfunctioning USB device reports an invalid configuration count. This could allow memory corruption, potentially leading to a crash or other unintended behavior on the affected system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- Linux Linux
From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 0b4ea4bfe16566b84645ded1403756a2dc4e0f19; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 9b8460a2a7ce478e0b625af7c56d444dc24190f7; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 62dc01c83fa71e10446ee4c31e0e3d5d1291e865; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 9887d859cd60727432a01564e8f91302d361b72b; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 920a369a9f014f10ec282fd298d0666129379f1b; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in b8f8b81dabe52b413fe9e062e8a852c48dd0680d; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 379d3b9799d9da953391e973b934764f01e03960; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in b909df18ce2a998afef81d58bbd1a05dc0788c40
- Linux Linux
2.6.12
References 9
git.kernel.org
- stable/c/0b4ea4bfe16566b84645ded1403756a2dc4e0f19
- stable/c/9b8460a2a7ce478e0b625af7c56d444dc24190f7
- stable/c/62dc01c83fa71e10446ee4c31e0e3d5d1291e865
- stable/c/9887d859cd60727432a01564e8f91302d361b72b
- stable/c/920a369a9f014f10ec282fd298d0666129379f1b
- stable/c/b8f8b81dabe52b413fe9e062e8a852c48dd0680d
- stable/c/379d3b9799d9da953391e973b934764f01e03960
- stable/c/b521b53ac6eb04e41c03f46f7fe452e4d8e9bcca
- stable/c/b909df18ce2a998afef81d58bbd1a05dc0788c40
Questions about CVE-2024-53197
What does this mean?
A USB device can report a bNumConfigurations value larger than the kernel's initial allocation in usb_get_configuration. This can lead to out-of-bounds memory accesses later, for example in usb_destroy_configuration.Source: git.kernel.org
Am I affected, and how do I check?
The issue is in the Extigy and Mbox audio device quirks of the Linux kernel ALSA usb-audio driver. The affected ranges are listed by upstream commit hash rather than by version number, so check whether your kernel source includes the fix commits for your branch.Source: git.kernel.org
What should I do about it?
Update to a kernel build that includes the upstream fix commits for your branch. The facts do not name a specific fixed version number.Source: git.kernel.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-04-09, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data